EDRi-gram newsletter - Number 9.24, 14 December 2011

[EDRI-gram newsletter]

============================================================

       EDRi-gram

biweekly newsletter about digital civil rights in Europe

Number 9.24, 14 December 2011

============================================================
Contents
============================================================

Support EDRi!
1. Council of Europe and European Commission initiatives on Internet freedom
2. Brief overview of the leaked EU Data Protection Regulation
3. Russian Government's new attempts to censor the Internet
4. European Parliament: raising awareness on "self"-regulation
5. Austria: Petition against Data Retention Directive
6. German web blocking law repealed
7. A fair Internet for all?
8. Transatlantic data privacy in debate at Privacy Conference
9. UK: Medical records in the open data programme?
10. Recommended Action
11. Recommended Reading
12. Agenda
13. About

============================================================
Support EDRi!
============================================================

Increasingly, your digital freedom is under threat. And unfortunately,
mostly as a result of European rules. Europe agreed to transfer your travel
data wholesale to the US. Europe obliged your telephone provider to store
your location, sometimes for up to two years. And Europe is considering
blocking websites and domain names. The list goes on.

This needs to stop. European Digital Rights (EDRi) defends your digital
freedom in Europe and needs your help. With a continuous stream of proposals
that risk eroding digital civil rights in Europe, your donation could make a
huge difference. The main goal at the moment is to keep funding the Brussels
office. This would allow us to continue to fight on all fronts mentioned
below.

If you didn't know yet, EDRi is a European non-governmental digital rights
organisation. We defend rights such as the freedom of expression, privacy,
data protection and access to knowledge. EDRi was founded in 2002 by 10
organisations from 7 European countries. Since then, EDRi membership has
grown consistently. Currently, EDRi represents 28 organisations from 18
countries in Europe. To find out more about our activities, you can read our
Annual Reports 2009 and 2010 or continue in reading EDRi-gram to be update
on a regular basis.

If you wish to help EDRi promote privacy and fundamental rights by
supporting our specialised office in Brussels, you may donate now to:

European Digital Rights Aisbl
Bank account nr.: 733-0215021-02
IBAN: BE32 7330 2150 2102
BIC: KREDBEBB

Beyond donations, you can always support EDRi!

Read and Share our Annual reports
http://www.edri.org/files/EDRi-yearly-reports-2009-2010.pdf

Flattr Us!
http://flattr.com/thing/417077/edri-on-Flattr

Promote the subscription to EDRi-gram, our free bi-weekly newsletter on
digital civil
rights in Europe
http://www.edri.org/edrigram/subscribe

Add a link or image to your website. Here are some images you might use:
http://edri.org/images/EDRi-animated-gif.gif
http://edri.org/images/EDRi_donate-300_250.png
http://edri.org/images/edri_Rebuilding.jpg

Volunteer! If you have some time and effort to spare we are always
looking for volunteers to help us in our work. Let us know what you're good
at and how you may help and we'll find a way to collaborate together.
http://www.edri.org/about/contact

Follow us on Twitter!
http://twitter.com/#!/edri_org

Check out EDRi on YouTube and Vimeo
http://www.youtube.com/user/EDRiorg
http://vimeo.com/edri

This is the last issue of EDRi-gram for this year, so we would like to thank
our loyal readers for their time, hints and feedback!!
Stay tuned for the next EDRi-gram, which will be published on 18 January
2012.

============================================================
1. Council of Europe and European Commission initiatives on Internet freedom
============================================================

On 8 December, the Council of Europe launched a very important Declaration
on "the protection of freedom of expression and freedom of assembly and
association with regard to privately operated Internet platforms and online
service providers." The text picks up many of the themes and priorities of
EDRi's study, published in January of this year, on the "Slide from
Self-Regulation to Corporate Censorship".

The text explains that "although privately operated, they are a significant
part of the public sphere through facilitating debate on issues of public
interest; in some cases, they can fulfil, similar to traditional media, the
role of a social "watchdog" and have demonstrated their usefulness in
bringing positive real-life change".

In the context of the positive obligations of states party to the Convention
on Human Rights to defend the rights in that instrument, the Declaration
explains that "direct or indirect political influence or pressure on new
media actors may lead to interference with the exercise of freedom of
expression, access to information and transparency, not only at a national
level but, given their global reach, also in a broader international
context."

The resolution explains that "the companies concerned are not immune to
undue interference; their decisions sometimes stem from direct political
pressure or from politically motivated economic compulsion, invoking
justification on the basis of compliance with their terms of service". The
text concludes by alerting "member States to the gravity of violations of
Articles 10 and 11 of the European Convention on Human Rights which might
result from politically motivated pressure exerted on privately operated
Internet platforms and online service providers, and of other attacks
against websites of independent media, human rights defenders, dissidents,
whistleblowers and new media actors."

Four days after the Council of Europe Ministerial Declaration was launched,
European Commissioner Vice President Neelie Kroes launched a "no disconnect
strategy" to "uphold the EU's commitment to ensure human rights and
fundamental freedoms are respected both online and off-line, and that
internet and other information and communication technology (ICT) can remain
a driver of political freedom, democratic development and economic growth."

The ambition of the announcement is quite limited in the first instance -
only addressing breaches of freedom of communication where "Europe perceives
that a vibrant and open Internet is not the norm or where grave human rights
abuses take place." While this lack of ambition is likely to come in for a
degree of criticism, it is nonetheless a step forward and should be
recognized and applauded as such.

One reason for the lack of ambition is the large range of restrictive
measures imposed by European countries in generally unsuccessful attempts to
enforce copyright. Currently, these include policies such as Internet
blocking, abuses of personal data and legal coercion of unconvicted
citizens. As if to underline the self-consciously contradictory nature of
the EU's policies in this area, Commissioner Kroes asked the unrepentant
German (alleged) plagiarist Mr Karl-Theodor zu Guttenburg (originally
described as representing US pressure group CSIS.org. that is not on the EU
transparency register) to work on the project with her. Mr zu Guttenberg is
best known for being shown to have copied his PhD thesis and, as a result,
having to resign from his former post as German Defence Minister. He is also
infamous for, together with his wife, launching a proposal for mandatory web
blocking in Germany.

Commissioner Kroes' obviously refined sense of irony failed to impress a
large number of online commentators, with a flurry of criticism appearing on
social media and on the Commissioner's blog.

Commissioner Kroes' response to criticism (13.12.2011)
http://blogs.ec.europa.eu/neelie-kroes/no-disconnect-response-issue/

EDRi study - "Slide from Self-Regulation to Corporate Censorship"
(24.01.2011)
http://www.edri.org/files/EDRI_selfreg_final_20110124.pdf

Council of Europe Committee of Ministers Declaration on the protection of
freedom of expression and freedom of assembly and association
with regard to privately operated Internet platforms and online service
providers (7.12.2011)
https://wcd.coe.int/ViewDoc.jsp?Ref=Decl%2807.12.2011%29&Language=lanEnglish&Ver=original&BackColorInternet=C3C3C3&BackColorIntranet=EDB021&BackColorLogged=F5D383

European Commission press release - Digital Agenda: Karl-Theodor zu
Guttenberg invited by Kroes to promote internet freedom globally
(12.12.2011)
http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/1525&format=HTML&aged=0&language=EN&guiLanguage=en

Mr zu Guttenberg's Phd scandal (1.03.2011)
http://www.guardian.co.uk/world/2011/mar/01/german-defence-minister-resigns-plagiarism

Mrs zu Guttenberg's child protection activities (19.10.2011)
http://www.guardian.co.uk/world/2010/oct/19/paedophile-entrapment-tv-show-germany

Legal coercion of EU citizens for copyright enforcement
http://en.wikipedia.org/wiki/ACS:Law

(Contribution by Joe McNamee - EDRi)

============================================================
2. Brief overview of the leaked EU Data Protection Regulation
============================================================

Last week, Europe was able to get a first glance at the "General Data
Protection Regulation" thanks to a leak by Statewatch. It is due to be
officially published on 25 January 2012 and will repeal the outdated Data
Protection Directive from 1995. It keeps the Directive's key principles but
also aims at taking into account the technological developments. It aims at
greater harmonisation and more "coherent" rules: "Differences in the level
of protection of the rights and freedoms of individuals may therefore
constitute an obstacle to the pursuit of economic activities at the level of
the Union, distort competition and impede authorities in the discharge of
their responsibilities under Union law."

The draft regulation introduces new rights and new definitions. Sensitive
data are now redefined to cover genetic and biometric data. The definition
of a data subject is mildly extended to a person who can be identified
directly or indirectly by the controller or "any natural or legal person".
New rights include clearer rights on data portability. It also introduces
mandatory reporting of data breaches as well as new competences and powers
for supervisory authorities in terms of independence and capacity. Moreover,
the regulation (article 63) establishes a European Data Protection Board
which is going to replace the existing Article 29 Working Party.

Article 2 of the Regulation defines the scope and states that it also
"applies to the processing of personal data of data subjects residing in the
Union not carried out in the context of the activities of an establishment
of a controller in the Union, where the processing activities are directed
to such data subjects, or serve to monitor the behaviour of such data
subjects." It will thus apply to businesses that have entities in Europe,
use equipment in the EU to process data or who have data processing
activities directed to EU data subjects or served to monitor their
behaviour.

Users can still make requests to access their data and ask for erasure. This
"right to be forgotten" (Art. 15) is basically a re-packaging of the already
existing right to deletion after the purpose has been fulfilled (Art. 12 of
Directive 95/46/EC). The current draft proposal goes further than the 1995
Directive proposing the right to erasure if the data are no longer necessary
or if the data subject withdraws his/her consent, including the right to
erasure of any public Internet link to, copy or replication of personal data
relating to the data subject in any public communication service. This
especially applies "in relation to personal data which are made available by
the data subject while he or she was a child".

It has already been argued that the article on the right to be forgotten was
not particularly well drafted and could therefore have serious and obviously
unintended implications for freedom of speech. Even though one of the aims
of this article is to counter the loss of purpose limitations in social
media, it must be carefully drafted to avoid its potential misuse as a tool
for censorship. It has also been criticised as data controllers, for
instance blogs or other independent media that do not comply with the 'right
to be forgotten', could be fined between 500 and 600 000 Euros.

One of the elements of the draft regulation that can be applauded is
represented by articles 37 and 42 which regulate data processing by third
countries. Data can be transferred to a third country only if certain
criteria are met to ensure the level of protection of individuals for the
protection of personal data. Article 42 addresses extra-territorial actions
by third countries such as the USA Patriot Act and the USA Foreign
Intelligence Surveillance Act and imposes barriers for foreign judicial
authorities to access European data. This article is particularly
interesting with regard to the US requests for European data such as the
request for twitter account details of European citizens that might be
related to WikiLeaks.

Proposal for a Regulation on the protection of individuals with
regard to the processing of personal data and on the free movement of such
data (General Data Protection Regulation)
http://www.statewatch.org/news/2011/dec/eu-com-draft-dp-reg-inter-service-consultation.pdf

9 Reasons Why a 'Right to be Forgotten' is Really Wrong (8.12.2011)
http://www.jorisvanhoboken.nl/?m=201112

A quick review of the draft EU Data Protection Regulation- Privacy
International (8.12.2011)
https://www.privacyinternational.org/article/quick-review-draft-eu-data-protection-regulation

(Contribution by Kirsten Fiedler - EDRi)

============================================================
3. Russian Government's new attempts to censor the Internet
============================================================

Especially during the period before and immediately after the Russian
parliamentary elections of 4 December 2011, government censorship
attacked not only traditional media, but also the Internet, which plays
now a very important role in the political debate in Russia with more than
51 million users.

An order from the Federal Security Service (FSB) asked social network
Vkontakte, with more than 5 million Russian users, to block the websites of
seven groups calling for demonstrations during the election days. As the
network refused to obey, Pavel Durov, its founder and director general, was
summoned to the Saint Petersburg prosecutor's office.

"This unreasonable order aims to deprive Internet users of the freedom of
expression, opinion and assembly. The authorities are using prevention of
violence as a pretext for reinforcing control of the Internet," Reporters
Without Borders said.

The Ria Novosti news agency was also allegedly ordered to clear its website
of any foreign news reports critical of Putin. Grigory Okhotin, recently
resigned from Inosmi, a Ria Novosti offshoot translating foreign media
articles into Russian and posting them on its website, stated on 26 November
that he had received an internal email from the head of the Internet
department asking all employees "not to post any article hostile to Putin
and United Russia on the site" during the week prior to the elections.

Also, reporters, photographers and bloggers that are critical to the
government were arrested either in the days previous to the elections or
while peacefully protesting in Moscow against the results of the
parliamentary elections and the irregularities that accompanied the polling.

Even regional forums were targeted. On 15 November, the police went to the
web-hosting company Agava Hosting and seized the server of Kostroma Jedis,
the region's most popular forum with 12 000 daily visitors, for having
posted two satirical videos criticizing governor Igor Slyunyayev.

Besides these attempts to stop protests directly, the Government also used
cyber attacks against blogs and Twitter accounts which have been flooded
with pro-government messages. Furthermore, several websites that are
critical of the government were blocked by Distributed Denial of Service
attacks before and during the elections. For instance, LiveJournal, a blog
platform hosting many anti-government blogs, was made inaccessible for three
days starting with 1 December.

Russia is classified as a "country under surveillance" in the latest
Reporters Without Borders press freedom index, and is part of the "Enemies
of the Internet" list in its latest report.

Vkontakte social network targeted by security services (9.12.2011)
http://en.rsf.org/russia-journalists-and-bloggers-arrested-06-12-2011,41519.html

Political debate disrupted by cyber-attacks and arrests (5.12.2011)
http://en.rsf.org/russie-government-tightens-control-of-all-01-12-2011,41489.html

Russia: Election Day DDoS-alypse (5.12.2011)
http://globalvoicesonline.org/2011/12/05/russia-election-day-ddos-alypse/

Russia: The Revolt of "Net Hamsters" (5.12.2011)
http://globalvoicesonline.org/2011/12/05/russia-the-revolt-of-net-hamsters/

============================================================
4. European Parliament: raising awareness on "self"-regulation
============================================================

What better way to raise awareness on private policing on the Internet than
to organise a workshop in the European Parliament and let the stakeholders
answer the question: "Self-regulation: Should online companies police the
internet?" On 7 December 2011 MEP Marietje Schaake organized, with support
from EDRi, an event on this issue. Among the speakers were representatives
from the European Commission, the content and internet industries and
civil society.

Representatives from the European Commission constituted the first panel.
Werner Stengg, from Directorate General Internal Market and Services, Head
of Unit Online Services, said, with regard to the E-commerce Directive,
there was no need for revision but a need for clarification on the "Notice
and Takedown" (now significantly broadened to "Notice and Action" - which
would cover any action by any intermediary rather than just hosting and mere
conduit providers). However three major, partially contradictory, issues
were raised in the consultation that need to be further discussed for 3
reasons:
1) takedowns are slow or not happening;
2) fragmentation of the rules;
3) there are civil rights at stake (particularly due to incentives to
takedown content leading to excessive takedowns; no fair appeal procedure;
lack of transparency).

On 11 January 2012, there will be a communication on the E-commerce
Directive. He agreed that the important issue was the liability regime,
however he had no idea on the outcome of his ongoing work on "Notice and
Action". He said that the Commission did not reject the idea of "Notice and
Notice". They are going to take every solution proposed into account and
analyse the pros and cons, before making any decision. Detailed analysis on
this point will not be in the Communication but will follow in the second
half of 2012.

Nicole Dewandre, special advisor to the Director General advisor for
Directorate General Information Society, talked about the Corporate Social
Responsibility (CSR) communication, which puts into place 2 actions:
firstly, a multistakeholder approach to Corporate Social Responsibility and
secondly, the improvement of self- and co-regulation processes. The DG
focuses on the Internet and the digital transition.

In the first round of questions, the audience raised the question on how the
right to fair trial/due process is going to be guaranteed, especially as
there are already examples of monitoring uploaded content operated via the
content ID platform. The 2003 inter-institutional agreement between the
Commission, Council and Parliament, which excludes self-regulation in cases
where fundamental rights are involved, was also evoked. However, no
conclusive response was given by DG InfSo on that concern. Finally, the
issue of how the concept of "do not track" would be implemented was raised,
due to doubts of some participants that this was working as a
self-regulation initiative. Wouldn't more regulation be a better solution
more than self-regulation?

In the second panel, Chris Ancliff, General Counsel of Warner Music Group,
and member of the board of directors of IFPI (International Federation of
Phonographic Industry) stated that ISPs help illegal content and businesses
to flourish. According to him, ISPs, search engines, credit card
companies and advertisers have their role to play in the enforcement of
copyright law. In his mind, asking ISPs to block access was not
unreasonable. He also said that ISPs have much to gain in the process
and that the only losers would be the pirates.

Joe McNamee of EDRi briefly described ten of the main misunderstandings that
led to self-regulation proposed by some policy-makers and industry
representatives. For example, he underlined that "self"-regulation is not an
isolated issue, that ISPs were not the right entities to enforce criminal
sanctions and that it often had unintended negative consequences on
copyright.

Chris Smith, representing composers and songwriters, focused on the question
of "who feeds the artist?" He also said that the ISPs must take
responsibility for the environment they created and are benefitting from.

According to the President of EuroISPA, Malcolm Hutty, Internet
intermediaries find themselves in the middle of an argument with EDRi on one
side and IFPI on the other. The issue however is far broader than copyright
since many different parties are interested in having ISPs police the
internet. ISPs face an important problem, how do deal with potentially
illegal content without causing harm to other interests? Transparency on
network management and removed material is important, but are ISPs the
competent and adequate bodies to deal with illegal/potentially illegal
content? Since blocking measures must be regulated, transparent and
proportionate, adequate safeguards must be put into place and he welcomed
the Directive on sexual exploitation of children on this point (which
rejected mandatory EU-wide blocking). Safeguards
in that Directive mean new rights granted to the citizens. Technical
measures are sometimes not possible and have consequences on reliability and
effectiveness.

Jermyn Brooks gave a brief introduction to the Global Network Initiative
(GNI) which was created as a multi-stakeholder initiative in order to
provide maximum transparency for users and set global standards for industry
in a self-regulatory model. In his opinion, self-regulation would be a good
solution to keep up with a quickly changing environment. However it should
not replace due process. GNI is looking for the right balance between the
principles of freedom of expression and privacy and security.

Marietje Schaake underlined the fact that there was a hierarchy between
fundamental rights. She asked if the cost of enforcement was not
disproportionate to the benefits.

To perfectly end the workshop, Malcolm Hutty stressed the necessity of
applying the rule of law to the online environment.

"Self"-regulation: Should online companies police the internet?
http://selfregulation.tumblr.com/post/13295080515/self-regulation-should-online-companies-police-the

Joe McNamee's speech (7.12.2011)
http://www.edri.org/files/presentation_7_Dec_2011.pdf

Video of the event - summary (14.12.2011)
https://www.youtube.com/watch?v=t9LR31m2yTA

(Contribution by Marie Humeau - EDRi)

============================================================
5. Austria: Petition against Data Retention Directive
============================================================

Today, 14 December 2011,  the Austrian Arbeitskreis Vorratsdaten (Working
Group against Data Retention Austria - AKVorrat.at) handed over a petition
to the Austrian Parliament, asking for the government to be obliged to
engage against the Data Retention Directive at the EU level and to evaluate
the whole set of existing anti-terror legislation.

Six years after the Data Retention Directive passed the European Parliament,
but only a few months after it was transposed into the national law, the
activists of AKVorrat presented the petition together with 4.471 Signatures
to the vice-director of the Austrian Parliament, Susanne Janistyn.

The Austrian Parliament has only recently introduced the possibility to sign
petitions online on its website, after they have been successfully submitted
on paper. Therefore, today's event in the Parliament only marks a mid-term
goal for AKVorrat. Starting form Monday next week a broad online campaign
will be launched to reach the goal of 10 000 signatures online. Austrian
citizens starting from the age of 16 are entitled to sign petitions on the
Parliament's website.

While data retention is the most prominent issue of the campaign, the
petition also targets the countless number of laws implemented with the
argument of fighting terrorism. Therefore, the Austrian Parliament is asked
to evaluate all of these laws and to abolish them, if they are found not to
be proportionate or necessary in a democratic society.

Only in April this year the Data Retention Directive was transposed into the
national Austrian law, which will come into force on 1 April 2012. From this
date on, Austrian citizens will have the opportunity to file complaints
against this law with the Constitutional Court of Austria. AKVorrat is
committed to use this opportunity extensively.

The Austrian Working Group to abolish the EU data retention directive visits
the vice-director of the Parliament Susanne Janistyn (14.12.2011)
https://www.vibe.at/node/52

Online-Campaign "Stoppt die Vorratsdatenspeicherung!" (only in German)
http://www.zeichnemit.at/

Arbeitskreis Vorratsdaten Vsterreich (AKVorrat.at) (only in German)
http://www.akvorrat.at

EDRi-gram 9.9:Data Retention has arrived in Austria (4.05.2011)
http://www.edri.org/edrigram/number9.9/austrian-data-retention-law

(contribution by Andreas Krisch - EDRi-member VIBE!AT - Austria)

============================================================
6. German web blocking law repealed
============================================================

After more than two years of discussions and opposition, on 1 December 2011,
the German Parliament has finally taken the decision to drop the Access
Impediment Act, the law that proposed blocking access to websites deemed to
have child pornographic content.

The decision was already considered by the German Government in April 2011
after the law had proven inefficient for its initial purpose of fighting
child pornography and after being largely opposed by freedom activists. An
online petition to have the law overturned was signed by 130 000 people. The
decision to have such sites blocked was "ineffective, counterproductive and
represented the beginning of internet censorship," said EDRi-member Chaos
Computer Club.

The law was asking ISPs to ban a list of websites compiled and considered as
"dubious" by the Federal Criminal Police Office. As in other cases, the
blocking measures proved to be easy to circumvent and therefore inefficient.
"Internet blockings are pointless. I need around five minutes to reconfigure
my browser if I want to view that material," said programmer and Pirate
Party member Stephan Urbach.

According to many experts, the only efficient method is deleting content.
"For years, the Internet industry has been working on the continued
improvement of successful deletion. This includes securing any evidence to
the end of criminal prosecution as well as international cooperation. Now,
it only takes us a few days to take illegal content off the net," stated
Oliver S|me, Vice-President of German Internet Industry Association.

According to Justice Minister Leutheusser-Schnarrenberger, the German
decision to abolish the Access Impediment Act will influence the decisions
taken at the European level.

The next steps are now with the Federal Council that needs to accept the
law, the President to sign it and then to be published in the German Federal
Law Gazette.

Bundestag looks to delete child pornography websites (2.12.2011)
http://www.dw-world.de/dw/article/0,,15575254,00.html

Access Impediment Act repealed (only in German, 1.12.2011)
http://mogis-verein.de/2011/12/01/zugangserschwerungsgesetz-aufgehoben/

Access Impediment Act repealed (only in German, 1.12.2011)
http://www.internet-law.de/2011/12/zugangserschwerungsgesetz-aufgehoben.html

EDRi-gram: German Internet blocking law to be withdrawn (6.04.2011)
http://www.edri.org/edrigram/number9.7/germany-internet-blocking-law

============================================================
7. A fair Internet for all?
============================================================

On 1 December 2011, the European Parliament's European People's Party (EPP)
group presented their strategy paper "A fair Internet for all -
Strengthening Our Citizens' Rights and Securing a Fair Business Environment
in the Internet". In this webstreamed hearing, the MEPs discussed the main
issues of the paper such as net and "search" neutrality, social networks,
online behavioural advertising, anonymity of users, cloud computing and
intellectual property rights. This was followed by an exchange of views with
Google, Facebook and Microsoft and the German Federal data protection
commission - who are, ostensibly "the" stakeholders in European Internet
regulation. Unfortunately, the EPP did not invite any civil society
representatives.

The strategy paper acknowledges that the Internet has created a new world of
possibilities and is an essential tool for communication, innovation, and
economic growth. It contains many positive elements such as a very strong
chapter on Net neutrality. The EPP group recognises that a neutral and open
free Internet represents guiding principle which must be preserved as a
policy objective. The group therefore urges the Commission to adopt further
measures to guarantee Net neutrality. Furthermore, the text defends privacy
by design, strong data protection rules in general and the need for better
harmonisation in order to avoid forum shopping. European standards should be
applied by companies where data is collected within the EU and transferred
to third countries.

While being a solid document overall, there is also some lack of coherence
on certain points. In section 3.a of its strategy paper, the EPP suggests
to further explore a "modification of the liability regime for
intermediaries". However, the EPP (and the European Parliament as a whole)
has already given its consent to the Free Trade Agreement with South Korea
in 2010, which basically copies the articles on intermediary liability of
the E-Commerce Directive into the Agreement and binds the European Union
with regard to the intermediary liability regime. Furthermore, this proposal
contradicts the EPP's principled position on net neutrality, which strongly
speaks in favour of the defence of the neutral role of Internet
intermediaries.

The EPP also adopts a very good position on profiling, stating that such
practices should be prohibited, but unfortunately has also given its consent
to agreements that allow profiling and data mining, such as the passenger
name record (PNR agreements) with third countries, such as Australia.

Hidden in its very last section on quality journalism online, the EPP's
paper introduces ancillary copyright provisions. It should be noted that in
September 2011, the German government announced to be in the process of
preparing a draft legislative proposal for ancillary copyright provisions.
This push for ancillary copyright provisions on a European level has already
been demanded by German chancellor Angela Merkel. However, ancillary
copyright provisions have already been harshly criticised by civil rights
groups, such as the initiative IGEL, stating that such provision would limit
the freedom of communication. The introduction of new copyright provisions
seems indeed unnecessary since publishers are already protected by copyright
provisions and get usually extensive rights by journalists through contracts
or general terms and conditions.

Overall, the EPP's strategy paper contains many good points and its adoption
should help facilitate discussions on the contradictions between principles
and practice that it has brought to light.

EPP Strategy Paper "Fair, Open and Secure Internet" (1.12.2011)
http://eppgroup.mobi/press/peve11/docs/111201wg-internet-strategy-paper_enII.pdf

Video - EPP presents its strategy paper (1.12.2011)
http://www.dailymotion.com/video/xmo39f_a-fair-internet-for-all-epp-group-presents-strategy-paper-watch-live_news

Initiative IGEL against ancillary copyright provisions (only in German)
http://leistungsschutzrecht.info/unterstuetzer

(Contribution by Kirsten Fiedler - EDRi)

============================================================
8. Transatlantic data privacy in debate at Privacy Conference
============================================================

The 2nd edition of the Annual European Data Protection and Privacy
Conference took place on 6 December 2011, mostly featuring speakers pulled
from its corporate sponsors, although it also included a few key European
institutions' representatives and data protection officials. There was no
place here for the civil society's voices apart from a representative from
BEUC, the European Consumers' Organisation.

The most interesting part of the conference were Viviane Reding and Cameron
Kerry's prepared speeches about the "Transatlantic solutions for data
privacy", the Vice President and Commissioner for Justice, Fundamental
Rights and Citizenship of the European Commission, and the General Counsel
at the US Department of Commerce respectively. Ms. Reding announced that her
office wants to "create a level playing field for companies", is "against
inconsistent rules because they are against business". She also recommended
the adoption and use of binding corporate rules in that regard; and
explained that she is in favour of the rule of "main establishment" to
decide when the EU data protection rules apply to companies. She announced
the following four rules as being the most important ones of the upcoming
European Commission's data protection regulatory framework: an easier access
to one's own personal data, a right to data portability, the acknowledgement
of the right to forget, and clearer rules for international data transfers.
She also made the point that, although she favours cloud computing in
Europe, strong data protection rules are good for business because they
enhance consumers' confidence. Worth noting is the point she made about the
US government agency's proposal for a Commercial Privacy Bill of Rights.
Although in principle in its favour, she did not agree with the use of only
voluntary codes of conduct.

Cameron Kerry announced that his department would soon release a White Paper
promoting consumer privacy that would provide a roadmap for the US
Government and consist of four pillars:
1) a consumer privacy Bill of Rights to provide protections for consumers
and greater certainty for businesses, and provide a uniform set of standards
that expands on the notice and choice principles;
2) it will convene multi-stakeholder processes including EU entities to
develop legally enforceable codes of conduct that expand on the Bill of
Rights, based on a voluntary participation by both consumers and businesses,
and enforceable by the Federal Trade Commission (FTC) once participants
would agree to abide by them;
3) "effective, fair and consistent" enforcement by the FTC;
4) a global interoperability in which "the Bill of Rights is a strong step
towards an international consensus on international privacy principles".

Although his speech sounded more like the usual Department of Commerce's
discourse considering privacy as an impediment to the benefits of free
trade, and unrestricted flows of information as enabling economic growth,
Mr. Kerry had a point when he alluded to the misconception some Europeans
have when they consider Americans as careless about privacy, and pinpointed
the deployment of data breach notification rules in the US as having had a
powerful incentive on companies' compliance with privacy rules.

During the next session about "Ensuring co-ordinated and harmonised data
protection laws across the EU", Jacob Kohnstamm, Chairman of the Article 29
Data Protection Working Party, emphasized that enforcing the rule of
establishment of the new data protection framework would only work if data
protection authorities are given much stronger enforcement powers and their
level of coordination is increased, without which "a level playing field in
the EU is impossible". Industry representatives all concurred on the need to
implement the "main establishment" rule, some saying that binding corporate
rules would limit the risk of forum shopping. Stephen Deadman from Vodafone
argued that the EU data protection regime is too legalistic ("we need less
rules, not more") while it should focus more on operational privacy. John
Vassallo of Microsoft, also in favour of the "main establishment" rule,
insisted that in order to avoid forum shopping, the criterion should be the
"primary physical infrastructure for processing data, the actual servers"
and that a clearer and more harmonized legal framework must be promoted.
Joan Antokol from Park Legal showed, through various examples based on her
health privacy practitioner's experience, the ways some European rules are
incoherent and should be harmonized across all EU Member States, while the
focus should be to eliminate rules and expenses that do bring added value to
protect individuals' privacy.

In a second session entitled "What will the effect of the new privacy rules
be on the online lives of EU citizens?", Marie-Helene Boulanger from the
Data Protection Unit of the European Commission stated that a recent survey
of European consumers shows that the expectation of individuals with regard
to the protection of their personal data is decreasing, pointing to the fact
that 70% of Europeans are concerned about the secondary use of their data
without consent, and the increasing demand of individuals for the
notification of data breaches by companies. Richard Allan of Facebook, asked
how his company complied in practice with the subject access right of the
Data Protection Directive and how it reacted to the string of complaints by
an Austrian law student before the Irish Data Protection Commissioner,
argued that his company had started discussions with the Irish authority to
try to iron out the scope of subject access requests in practice, although
he avoided to answer the more specific question as to whether that right to
access also included the meta-data associated with each Facebook user's
profile.

In the session about "Rebuilding consumer confidence in data protection
laws", Kostas Rossoglou of BEUC argued about the need for stronger redress
and compensation rules, including a right to collective redress; also that
self-regulation is only a solution if it fully complies with the law,
benefits consumers, and is effectively enforced, which has according to him,
never been the case thus far. David Smith of the UK Data Protection
Authority said that his office was interested in seeing trustmarks and seals
developed in a simple and effective way; that fines drive compliance; and
that individuals' access rights should be simple to use, whereas it is
generally hard to exercise in practice.

On the last panel entitled "What shape for globalised data protection and
privacy laws in the 21st century?", Peter Hustinx, the European Data
Protection Supervisor, stated about the prospective European data protection
legal framework that the criterion of application would be enhanced with a
"targeting" rule: whether the data protection rules apply will depend on
whether the data controllers are considered to target EU-based individuals
when processing their personal data, or monitor them online. He also added
that the meaning and scope of the concept of "adequate protection" would
likely be clarified by the European Commission.

Event webpage
http://www.eu-ems.com/summary.asp?event_id=97&page_id=681

(Contribution by Cedric Laurant - EDRi observer)

============================================================
9. UK: Medical records in the open data programme?
============================================================

British Prime Minister David Cameron announced that, under his "open
data" programme, all UK medical records will in future be made
available to researchers in both academia and the pharmaceutical
industry, unless patients opt out. They will be "anonymised"; at
present this process consists of replacing patients' names with the
combination of postcode plus date of birth, by which most citizens can
easily be re-identified.

Everyone 'to be research patient', says David Cameron (5.12.2011)
http://www.bbc.co.uk/news/uk-16026827

NHS open data plans 'death of privacy' (5.12.2011)
http://www.ehi.co.uk/news/acute-care/7376/nhs-open-data-plans-%27death-of-privacy%27

Further Detail on Open Data Measures in the Autumn Statement 2011
(29.11.2011)
http://www.cabinetoffice.gov.uk/resource-library/open-data-measures-autumn-statement-2011

How anonymous is NHS patient data? (12.12.2011)
http://www.guardian.co.uk/healthcare-network/2011/dec/12/nhs-patient-data-anonymity

Here we go again (4.12.2011)
http://www.lightbluetouchpaper.org/2011/12/04/here-we-go-again/

Anonymity is hard to do well - scientific papers
http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c09.pdf
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006

(Contribution by Ross Anderson - EDRi-member FIPR -UK)

============================================================
10. Recommended Action
============================================================

CSISAC, the Civil Society Information Society Advisory Council to the OECD,
of which EDRI is a founding and steering committee member, is looking for
its Community Manager and Liaison to OECD. If you are a brilliant and
experienced community manager, people-motivator, public-interest advocate,
while being a diplomat, knowledgeable and showing strong interest in policy
related to the internet, telecommunications and information society, check
the job offer and full job description at
http://csisac.org/2011/12/csisac_job_opening_community_m.php
Deadline for applications by email: 31 December 2011

============================================================
11. Recommended Reading
============================================================

Digital Agenda: Turning government data into gold (12.12.2011)
http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/1524&format=HTML&aged=0&language=EN&guiLanguage=en
http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/11/891&format=HTML&aged=0&language=EN&guiLanguage=en

EDPS opinion on EU-US Passenger Name Record agreement (13.12.2011)
http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2011/11-12-09_US_PNR_EN.pdf
http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/PressNews/Press/2011/EDPS-2011-12_US-PNR_EN.pdf

The State of Surveillance: The Data (1.12.2011)
http://www.bigbrotherinc.org/

Global Information Society Watch report 2011 - Internet rights and
democratisation
http://giswatch.org/en/2011

Internet censorship against streaming in France? (1.12.2011)
https://www.laquadrature.net/en/internet-censorship-against-streaming-in-france

============================================================
12. Agenda
============================================================

27-30 December 2011, Berlin, Germany
28C3 - 28th Chaos Communication Congress
http://events.ccc.de/category/28c3/
http://events.ccc.de/congress/2011/

25-27 January 2012, Brussels, Belgium
Computers, Privacy and Data Protection 2012
http://www.cpdpconferences.org/

26 January 2012, Schaarbeek, Belgium
Big Brother Awards Belgium
http://www.bigbrotherawards.be/

25 February 2012, Szeged, Hungary
Copyright and Human Rights in the Information Age: Conflict or Harmonious
Coexistence
CfP by 16 January 2012
http://www.juris.u-szeged.hu/english/news/conference-on-copyright

16-18 April 2012, Cambridge, UK
Cambridge 2012: Innovation and Impact - Openly Collaborating to Enhance
Education
OER12 and the OCW Consortium's Global Conference
http://conference.ocwconsortium.org/index.php/2012/uk

14-15 June 2012, Stockholm, Sweden
EuroDIG 2012
Submissions open by 31 December 2011
http://www.eurodig.org/

9-10 July 2012, Barcelona, Spain
8th International Conference on Internet Law & Politics: Challenges and
Opportunities of Online Entertainment
Abstracts deadline: 20 December 2011
http://edcp.uoc.edu/symposia/idp2012/cfp/?lang=en

12-14 September 2012, Louvain-la-Neuve, Belgium
Building Institutions for Sustainable Scientific, Cultural and genetic
Resources Commons.
Call for abstracts deadline: 15 January 2012
http://biogov.uclouvain.be/iasc/index.php

============================================================
13. About
============================================================

The next EDRi-gram will be published on 18 January 2012.

EDRi-gram is a biweekly newsletter about digital civil rights in Europe.
Currently EDRi has 28 members based or with offices in 18 different
countries in Europe. European Digital Rights takes an active interest in
developments in the EU accession countries and wants to share knowledge and
awareness through the EDRi-grams.

All contributions, suggestions for content, corrections or agenda-tips are
most welcome. Errors are corrected as soon as possible and are visible on
the EDRi website.

This EDRi-gram has been published with financial support from the EU's
Fundamental Rights and Citizenship Programme.

Except where otherwise noted, this newsletter is licensed under the
Creative Commons Attribution 3.0 License. See the full text at
http://creativecommons.org/licenses/by/3.0/

Newsletter editor: Bogdan Manolea <edrigram at edri.org>

Information about EDRI and its members:
http://www.edri.org/

European Digital Rights needs your help in upholding digital rights in the
EU. If you wish to help us promote digital rights, please consider making a
private donation.
http://www.edri.org/about/sponsoring
http://flattr.com/thing/417077/edri-on-Flattr

- EDRI-gram subscription information

subscribe by e-mail
To: edri-news-request at edri.org
Subject: subscribe

You will receive an automated e-mail asking to confirm your request.
Unsubscribe by e-mail
To: edri-news-request at edri.org
Subject: unsubscribe

- EDRI-gram in Macedonian

EDRI-gram is also available partly in Macedonian, with delay. Translations
are provided by Metamorphosis
http://www.metamorphosis.org.mk/edri/2.html

- EDRI-gram in German

EDRI-gram is also available in German, with delay. Translations are provided
Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for
Internet Users
http://www.unwatched.org/

- Newsletter archive

Back issues are available at:
http://www.edri.org/edrigram

- Help
Please ask <edrigram at edri.org> if you have any problems with subscribing or
unsubscribing.

----- End forwarded message -----
-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE